General
-
Target
2803989c03d0d864c20efb1317b157af.bin
-
Size
724KB
-
Sample
230324-bk6lxadc7x
-
MD5
9d3977d6eb2394e959b2df6589db297c
-
SHA1
704fc7c37b106b8c059b08980e290f3b788ef1bb
-
SHA256
ab0fa60ea91b68f9724e616bfb74fc05b98b83bc8b69e46295357ad350bdd60e
-
SHA512
1b0b6aff626dfe032f589b1ec068ef36cc5715e1727d5971903722041555876e3b4728d1dcfa488edb47c14dda9442ea4ce043c6efd7c579ed277723c957acba
-
SSDEEP
12288:4Y38ASsXmpg1Ym7tlciEM6g58ygZKz4pZv8t8dzfaO8KQWsHTMZG:4VASddatlcJM6gabpZzzy5yG
Malware Config
Extracted
formbook
4.1
jr22
941zhe.com
lunarportal.space
xn--osmaniyeiek-t9ab.online
trejoscar.com
nrnursery.com
quizcannot.cfd
seedstockersthailand.com
watsonwindow.com
wjfholdings.com
weziclondon.com
naruot.xyz
yeji.plus
classicmenstore.com
oharatravel.com
therapyplankits.com
keviegreshonpt.com
qdlyner.com
seithupaarungal.com
casinorates.online
8ug4as.icu
Targets
-
-
Target
c5963a1865a79e63cf6c451a27db54911fe38cfda287fbf537eb15878666db89.exe
-
Size
797KB
-
MD5
2803989c03d0d864c20efb1317b157af
-
SHA1
85899fc6132aeedba1eae771a3f74a641b741cf0
-
SHA256
c5963a1865a79e63cf6c451a27db54911fe38cfda287fbf537eb15878666db89
-
SHA512
706dbf3a3d984f929b131d987f2b83fed5719b5365a43aa82534f2e6ef63134f2170b3e40135df1870593a309b78c0be765754d4c8f6df7844f813761d1cf0c5
-
SSDEEP
12288:KnXTcAmWc6pl3i3fkuzxrB3VqJLPo6e1OrsxVRGyTWBwLN6aAsI++HVeRjLwbYW:goAE24jNBEkKsjIDDsM1Jc
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-